From fd8cac96262d5cbc24916c4ef126d15a6470b9e8 Mon Sep 17 00:00:00 2001
From: smallgun01 <smallgun01@gmail.com>
Date: Fri, 26 Jun 2026 14:51:08 +0800
Subject: [PATCH 1/2] Docs(opencode): add API key provider config example

---
 docs/opencode.md | 38 ++++++++++++++++++++++++++++++++++++++
 1 file changed, 38 insertions(+)

diff --git a/docs/opencode.md b/docs/opencode.md
index b762a0a46..a6035ccc3 100644
--- a/docs/opencode.md
+++ b/docs/opencode.md
@@ -193,6 +193,44 @@ kubectl rollout restart deployment/openab-opencode
 
 > **Important:** Do NOT set a custom `baseURL` or provider override for xAI. The built-in xAI provider handles routing correctly. A stale `~/.config/opencode/opencode.json` with `baseURL: "http://localhost:9090/v1"` (from xai-proxy setups) will break xAI — delete it if present.
 
+## Example: API Key Providers
+
+For providers that use API keys instead of OAuth (e.g. opencode-go, custom
+OpenAI-compatible endpoints), the config needs the full `provider` block with
+`options.apiKey`:
+
+### 1. Set the model and API key
+
+Create `opencode.json` in the working directory (`/home/node`). The key
+difference from OAuth providers is the `provider.options.apiKey` field:
+
+```bash
+kubectl exec -it deployment/openab-opencode -- bash -c 'cat > /home/node/opencode.json << EOF
+{
+  "provider": {
+    "opencode-go": {
+      "options": {
+        "baseURL": "https://opencode.ai/zen/go/v1",
+        "apiKey": "${OPENCODE_API_KEY}"
+      },
+      "models": {
+        "deepseek-v4-flash": {}
+      }
+    }
+  },
+  "model": "opencode-go/deepseek-v4-flash"
+}
+EOF'
+```
+
+> Inject `OPENCODE_API_KEY` via a Kubernetes Secret as an environment variable.
+
+### 2. Restart to pick up config
+
+```bash
+kubectl rollout restart deployment/openab-opencode
+```
+
 ## Notes
 
 - **Tool authorization**: OpenCode handles tool authorization internally and never emits `session/request_permission` — all tools run without user confirmation, equivalent to `--trust-all-tools` on other backends.

From c5951cad469cb9e6b57a6b805c8ccf425c5d976b Mon Sep 17 00:00:00 2001
From: smallgun01 <smallgun01@gmail.com>
Date: Sat, 27 Jun 2026 15:23:34 +0800
Subject: [PATCH 2/2] Docs: switch to {env:OPENCODE_API_KEY} per review

The shell-style `${OPENCODE_API_KEY}` worked in the kubectl exec heredoc
because bash expands it before writing, but `{env:VAR}` is the portable
opencode-native form documented at
https://opencode.ai/docs/config/#env-vars.

Closes review feedback from @thepagent.
---
 docs/opencode.md | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/docs/opencode.md b/docs/opencode.md
index a6035ccc3..5a40d05f8 100644
--- a/docs/opencode.md
+++ b/docs/opencode.md
@@ -211,7 +211,7 @@ kubectl exec -it deployment/openab-opencode -- bash -c 'cat > /home/node/opencod
     "opencode-go": {
       "options": {
         "baseURL": "https://opencode.ai/zen/go/v1",
-        "apiKey": "${OPENCODE_API_KEY}"
+        "apiKey": "{env:OPENCODE_API_KEY}"
       },
       "models": {
         "deepseek-v4-flash": {}
@@ -224,6 +224,11 @@ EOF'
 ```
 
 > Inject `OPENCODE_API_KEY` via a Kubernetes Secret as an environment variable.
+>
+> Note: shell-style `${OPENCODE_API_KEY}` would also work in this specific
+> heredoc (bash expands it before writing), but only here. `{env:VAR}` is the
+> form that works everywhere.
+
 
 ### 2. Restart to pick up config